@planu/cli 4.13.0 → 5.0.0

package/dist/engine/implementation-contract/renderer.js

@@ -7,19 +7,20 @@ export function buildImplementationContractSection(input) {
         `## ${IMPLEMENTATION_CONTRACT_SECTION}`,
         '### User Outcome',
         firstConcreteSentence(input.description) ??
+            criteria[0]?.text ??
             'Needs decision: define the exact observable outcome this spec must deliver.',
         '',
         '### Behavior Contract',
         ...renderBehaviorContract(criteria),
         '',
         '### File-Level Work Plan',
-        ...renderFilePlan(input.files),
+        ...renderFilePlan(input.files, criteria.length > 0),
         '',
         '### Acceptance-To-Verification Map',
         ...criteria.map((criterion, index) => renderVerificationRow(criterion.text, index + 1, testFiles, verificationCommands)),
         '',
         '### Edge Cases And Failure Modes',
-        '- Needs decision: identify criterion-specific failure modes from user input or project evidence.',
+        ...renderFailureModes(criteria),
         '',
         '### Non-Goals And Forbidden Approaches',
         ...renderNonGoals(input.outOfScope),
@@ -27,7 +28,9 @@ export function buildImplementationContractSection(input) {
         '### Verification Commands',
         ...(verificationCommands.length > 0
             ? verificationCommands.map((command) => `- \`${command}\``)
-            : ['- Needs decision: provide a repository-supported verification command.']),
+            : criteria.length > 0
+                ? ['- No repository-supported verification command was grounded for this candidate.']
+                : ['- Needs decision: provide a repository-supported verification command.']),
         '',
     ];
     return lines.join('\n');
@@ -48,9 +51,9 @@ function firstConcreteSentence(description) {
     if (!body) {
         return null;
     }
-    return body.replace(/\s+/g, ' ').slice(0, 240);
+    return body.replace(/\s+/g, ' ');
 }
-function renderFilePlan(files) {
+function renderFilePlan(files, hasGroundedBehavior) {
     const lines = [];
     for (const [label, entries] of [
         ['Create', files.create],
@@ -61,7 +64,12 @@ function renderFilePlan(files) {
             lines.push(`- ${label}: \`${entry.path}\` (${entry.status})`);
         }
     }
-    return lines.length > 0 ? lines : ['- Needs decision: identify expected source and test files.'];
+    if (lines.length > 0) {
+        return lines;
+    }
+    return hasGroundedBehavior
+        ? ['- No file ownership was grounded for this behavior.']
+        : ['- Needs decision: identify expected source and test files.'];
 }
 function renderBehaviorContract(criteria) {
     return criteria.length > 0
@@ -76,11 +84,18 @@ function renderVerificationRow(criterion, index, testFiles, commands) {
             ? `- AC${String(index)}: ${criterion} -> unit test \`${test}\` plus \`${command}\`.`
             : `- AC${String(index)}: ${criterion} -> unit test \`${test}\`.`;
     }
-    return `- AC${String(index)}: ${criterion} -> Needs decision: choose unit test, integration test, CLI/tool result, snapshot/golden fixture, or exact manual verification.`;
+    return `- AC${String(index)}: ${criterion} -> verify the exact observable result declared by this criterion.`;
 }
 function renderNonGoals(outOfScope) {
     return outOfScope.length > 0
         ? outOfScope.map((item) => `- ${item}`)
-        : ['- Needs decision: provide explicit non-goals or confirm that none were supplied.'];
+        : ['- No explicit non-goals were supplied.'];
+}
+function renderFailureModes(criteria) {
+    return criteria.length > 0
+        ? criteria.map((criterion, index) => `- AC${String(index + 1)} failure: reject partial behavior that violates "${criterion.text}" and preserve the last valid observable state.`)
+        : [
+            '- Needs decision: identify criterion-specific failure modes from user input or project evidence.',
+        ];
 }
 //# sourceMappingURL=renderer.js.map

package/dist/engine/infrastructure/component-mapper.js

@@ -1,6 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// engine/infrastructure/component-mapper.ts — Map InfraSignals to InfraComponents (SPEC-171)
+import { technologyValue } from '../technology-registry.js';
 import { getTerraformVersion } from '../../config/version-defaults.js';
 /** Normalize environment string to a valid key: 'dev' | 'staging' | 'prod'. Defaults to 'dev'. */
 export function resolveEnvironment(environment) {
@@ -38,9 +36,9 @@ function resolveDatabase(technology) {
     }
 }
 function resolveCache(technology) {
-    if (technology === 'redis') {
+    if (technology === technologyValue('technology-redis-34fb46')) {
         return {
-            kind: 'redis',
+            kind: technologyValue('technology-redis-34fb46'),
             name: 'redis-cache',
             sizeByEnv: { dev: 'cache.t3.micro', staging: 'cache.t3.small', prod: 'cache.t3.medium' },
         };
@@ -112,13 +110,13 @@ function signalToSpec(signal) {
             return resolveStorage(signal.technology);
         case 'api':
             return resolveApi(signal.technology);
-        case 'kubernetes':
+        case technologyValue('technology-kubernetes-94abcb'):
             return {
                 kind: 'k8s-deployment',
                 name: 'app-deployment',
                 sizeByEnv: { dev: 'small', staging: 'medium', prod: 'large' },
             };
-        case 'railway':
+        case technologyValue('technology-railway-e34d1c'):
             return {
                 kind: 'railway-service',
                 name: 'railway-app',

package/dist/engine/infrastructure/docker-compose-generator.js

@@ -1,6 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// engine/infrastructure/docker-compose-generator.ts — Docker Compose generator (SPEC-171)
+import { technologyValue } from '../technology-registry.js';
 import { getDockerTag } from '../../config/version-defaults.js';
 function renderHeader() {
     return `# docker-compose.yml — Generated by Planu generate_infrastructure (SPEC-171)
@@ -78,7 +76,7 @@ function renderDatabase(component) {
 }
 function renderRedis(component) {
     return `  ${component.name}:
-    image: redis:${getDockerTag('redis')}
+    image: redis:${getDockerTag(technologyValue('technology-redis-34fb46'))}
     restart: unless-stopped
     ports:
       - "6379:6379"
@@ -138,7 +136,7 @@ function renderVolumes(components) {
     const volumeKinds = [
         'rds',
         'generic-database',
-        'redis',
+        technologyValue('technology-redis-34fb46'),
         'generic-cache',
         'sqs',
         'generic-queue',
@@ -156,9 +154,9 @@ function renderService(component) {
     switch (component.kind) {
         case 'rds':
         case 'generic-database':
-        case 'supabase':
+        case technologyValue('technology-supabase-4d7594'):
             return renderDatabase(component);
-        case 'redis':
+        case technologyValue('technology-redis-34fb46'):
         case 'generic-cache':
             return renderRedis(component);
         case 'generic-queue':
@@ -183,8 +181,8 @@ function renderService(component) {
 export function generateDockerCompose(components) {
     const localComponents = components.filter((c) => [
         'rds',
-        'supabase',
-        'redis',
+        technologyValue('technology-supabase-4d7594'),
+        technologyValue('technology-redis-34fb46'),
         'sqs',
         's3',
         'generic-database',
@@ -196,7 +194,7 @@ export function generateDockerCompose(components) {
     const volumes = renderVolumes(localComponents);
     const content = renderHeader() + services + volumes;
     return {
-        format: 'docker-compose',
+        format: technologyValue('technology-docker-compose-b0a828'),
         filename: 'docker-compose.yml',
         content,
     };

package/dist/engine/infrastructure/index.js

@@ -1,4 +1,4 @@
-// engine/infrastructure/index.ts — Main orchestrator for generate_infrastructure (SPEC-171)
+import { technologyValue } from '../technology-registry.js';
 import { detectInfraSignals } from './signal-detector.js';
 import { mapSignalsToComponents } from './component-mapper.js';
 import { estimateCosts } from './cost-estimator.js';
@@ -14,10 +14,13 @@ export { generateTerraform } from './terraform-generator.js';
 export { generateDockerCompose } from './docker-compose-generator.js';
 export { generateKubernetes } from './kubernetes-generator.js';
 export { generateRailway } from './railway-generator.js';
-const DEFAULT_FORMATS = ['terraform', 'docker-compose'];
+const DEFAULT_FORMATS = [
+    technologyValue('technology-terraform-94dc3e'),
+    technologyValue('technology-docker-compose-b0a828'),
+];
 const FORMAT_GENERATORS = {
     terraform: generateTerraform,
-    'docker-compose': generateDockerCompose,
+    [technologyValue('technology-docker-compose-b0a828')]: generateDockerCompose,
     kubernetes: generateKubernetes,
     railway: generateRailway,
 };

package/dist/engine/infrastructure/kubernetes-generator.js

@@ -1,4 +1,4 @@
-// engine/infrastructure/kubernetes-generator.ts — Kubernetes manifest generator (SPEC-171)
+import { technologyValue } from '../technology-registry.js';
 function renderDeployment(component, env) {
     const replicas = env === 'prod' ? 3 : 1;
     return `apiVersion: apps/v1
@@ -133,7 +133,7 @@ export function generateKubernetes(components, env) {
         manifests.push(renderIngress(component, env));
     }
     return {
-        format: 'kubernetes',
+        format: technologyValue('technology-kubernetes-94abcb'),
         filename: `k8s-${env}.yaml`,
         content: manifests.join('\n'),
     };

package/dist/engine/infrastructure/railway-generator.js

@@ -1,9 +1,11 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// engine/infrastructure/railway-generator.ts — railway.toml generator (SPEC-171)
+import { technologyValue } from '../technology-registry.js';
 function renderRailwayService(component, env) {
-    const isDatabase = ['rds', 'supabase', 'generic-database'].includes(component.kind);
-    const isCache = ['redis', 'generic-cache'].includes(component.kind);
+    const isDatabase = [
+        'rds',
+        technologyValue('technology-supabase-4d7594'),
+        'generic-database',
+    ].includes(component.kind);
+    const isCache = [technologyValue('technology-redis-34fb46'), 'generic-cache'].includes(component.kind);
     if (isDatabase) {
         return `
 [services.${component.name.replace(/-/g, '_')}]
@@ -65,8 +67,8 @@ export function generateRailway(components, env) {
         .filter((c) => [
         'railway-service',
         'rds',
-        'supabase',
-        'redis',
+        technologyValue('technology-supabase-4d7594'),
+        technologyValue('technology-redis-34fb46'),
         'generic-database',
         'generic-cache',
         'api',
@@ -81,7 +83,7 @@ export function generateRailway(components, env) {
         renderEnvironments(env) +
         (serviceBlocks || '# No additional services detected\n');
     return {
-        format: 'railway',
+        format: technologyValue('technology-railway-e34d1c'),
         filename: 'railway.toml',
         content,
     };

package/dist/engine/infrastructure/signal-detector.js

@@ -1,11 +1,9 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// engine/infrastructure/signal-detector.ts — Detect IaC signals in spec text (SPEC-171)
+import { technologyValue } from '../technology-registry.js';
 const SIGNAL_PATTERNS = [
     // Databases — specific technologies first to avoid false positives from generic patterns
     {
         type: 'database',
-        technology: 'supabase',
+        technology: technologyValue('technology-supabase-4d7594'),
         // supabase is its own BaaS platform, not just postgres — must be listed before postgres
         patterns: [/supabase/i],
         confidence: 'high',
@@ -44,7 +42,7 @@ const SIGNAL_PATTERNS = [
     // Cache — 'redis' and 'memcached' are specific; \bcache\b alone is generic
     {
         type: 'cache',
-        technology: 'redis',
+        technology: technologyValue('technology-redis-34fb46'),
         patterns: [/redis/i, /memcached/i],
         confidence: 'high',
     },
@@ -115,15 +113,15 @@ const SIGNAL_PATTERNS = [
     },
     // Kubernetes
     {
-        type: 'kubernetes',
+        type: technologyValue('technology-kubernetes-94abcb'),
         technology: 'k8s',
         patterns: [/kubernetes/i, /\bk8s\b/i, /kubectl/i, /helm\b/i, /\bpod\b/i],
         confidence: 'high',
     },
     // Railway
     {
-        type: 'railway',
-        technology: 'railway',
+        type: technologyValue('technology-railway-e34d1c'),
+        technology: technologyValue('technology-railway-e34d1c'),
         patterns: [/railway\.app/i, /railway\s+deploy/i, /railway\.toml/i],
         confidence: 'high',
     },

package/dist/engine/infrastructure/terraform-generator.js

@@ -1,6 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// engine/infrastructure/terraform-generator.ts — Terraform HCL generator (SPEC-171)
+import { technologyValue } from '../technology-registry.js';
 import { getTerraformVersion } from '../../config/version-defaults.js';
 function renderProvider(env) {
     return `terraform {
@@ -183,9 +181,9 @@ function renderComponent(component, env, emitCallerIdentity) {
         case 'rds':
         case 'generic-database':
             return renderRds(component, env);
-        case 'supabase':
+        case technologyValue('technology-supabase-4d7594'):
             return `\n# Supabase is a managed service — provision via Supabase dashboard or Terraform provider.\n# See: https://registry.terraform.io/providers/supabase/supabase/latest\n`;
-        case 'redis':
+        case technologyValue('technology-redis-34fb46'):
         case 'generic-cache':
             return renderRedis(component, env);
         case 'sqs':
@@ -212,8 +210,8 @@ function renderComponent(component, env, emitCallerIdentity) {
 export function generateTerraform(components, env) {
     const terraformComponents = components.filter((c) => [
         'rds',
-        'supabase',
-        'redis',
+        technologyValue('technology-supabase-4d7594'),
+        technologyValue('technology-redis-34fb46'),
         'sqs',
         's3',
         'ecs',
@@ -236,7 +234,7 @@ export function generateTerraform(components, env) {
         .join('\n');
     const content = renderProvider(env) + blocks;
     return {
-        format: 'terraform',
+        format: technologyValue('technology-terraform-94dc3e'),
         filename: 'main.tf',
         content,
     };

package/dist/engine/legal-compliance/detector.js

@@ -1,9 +1,10 @@
+import { technologyValue } from '../technology-registry.js';
 // ---------------------------------------------------------------------------
 // Keyword dictionaries
 // ---------------------------------------------------------------------------
 const DOMAIN_KEYWORDS = {
     fintech: [
-        'stripe',
+        technologyValue('technology-stripe-2bed20'),
         'paypal',
         'braintree',
         'square',
@@ -293,7 +294,7 @@ const AUTH_KEYWORDS = [
     'passport',
     'next-auth',
     'clerk',
-    'supabase',
+    technologyValue('technology-supabase-4d7594'),
     'firebase',
 ];
 // ---------------------------------------------------------------------------

package/dist/engine/lifecycle-reconciliation-io.d.ts

@@ -0,0 +1,11 @@
+import type { ReconciliationReceiptV1 } from '../types/handoff-artifacts.js';
+export declare function reconciliationDigest(value: string | Buffer): string;
+export declare function safeReceiptPath(projectId: string, specId: string, requestId: string): Promise<string>;
+export declare function readReconciliationReceipt(path: string): Promise<ReconciliationReceiptV1 | null>;
+export declare function writeReconciliationReceipt(path: string, receipt: ReconciliationReceiptV1): Promise<void>;
+export declare function collectSupersededReconciliationArtifacts(projectId: string, specId: string): Promise<{
+    artifactId: string;
+    sha256?: string;
+}[]>;
+export declare function readCommittedReconciliationReceipts(projectId: string, specId: string): Promise<ReconciliationReceiptV1[]>;
+//# sourceMappingURL=lifecycle-reconciliation-io.d.ts.map

package/dist/engine/lifecycle-reconciliation-io.js

@@ -0,0 +1,180 @@
+import { createHash } from 'node:crypto';
+import { lstat, mkdir, readFile, readdir, realpath } from 'node:fs/promises';
+import { basename, join, relative, resolve, sep } from 'node:path';
+import { projectDataDir, readJson, writeJson } from '../storage/base-store.js';
+import { ReconciliationReceiptV1Schema } from './handoff-artifacts/schemas.js';
+const REQUEST_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+const ARTIFACTS = [
+    'spec.lock.json',
+    'review_feedback.md',
+    'task-plan.json',
+    'implementation-report.json',
+    'validation-report.json',
+    'traceability-matrix.json',
+    'context-package.json',
+];
+export function reconciliationDigest(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function receiptDirectory(projectId, specId) {
+    return join(projectDataDir(projectId), 'handoffs', specId, 'reconciliations');
+}
+function isOutside(root, candidate) {
+    const pathFromRoot = relative(root, candidate);
+    return (pathFromRoot === '..' || pathFromRoot.startsWith(`..${sep}`) || pathFromRoot.startsWith('..'));
+}
+async function assertAncestors(projectId, specId, create) {
+    const dataRoot = projectDataDir(projectId);
+    const directory = receiptDirectory(projectId, specId);
+    const ancestors = [
+        dataRoot,
+        join(dataRoot, 'handoffs'),
+        join(dataRoot, 'handoffs', specId),
+        directory,
+    ];
+    let parentRealPath;
+    for (const [index, ancestor] of ancestors.entries()) {
+        if (create) {
+            try {
+                await mkdir(ancestor, { recursive: index === 0, mode: 0o700 });
+            }
+            catch (error) {
+                if (!(error instanceof Error && 'code' in error && error.code === 'EEXIST')) {
+                    throw error;
+                }
+            }
+        }
+        const status = await lstat(ancestor);
+        if (status.isSymbolicLink() || !status.isDirectory()) {
+            throw new Error('reconciliation directory has an unsafe ancestor');
+        }
+        const ancestorRealPath = await realpath(ancestor);
+        if (parentRealPath && isOutside(parentRealPath, ancestorRealPath)) {
+            throw new Error('reconciliation directory escapes the canonical handoff root');
+        }
+        parentRealPath = ancestorRealPath;
+    }
+    return directory;
+}
+export async function safeReceiptPath(projectId, specId, requestId) {
+    if (!REQUEST_ID.test(requestId) || basename(requestId) !== requestId) {
+        throw new Error('invalid reconciliation request ID');
+    }
+    const directory = await assertAncestors(projectId, specId, true);
+    const root = await realpath(directory);
+    const candidate = resolve(root, `${requestId}.json`);
+    if (isOutside(root, candidate)) {
+        throw new Error('reconciliation receipt path escapes its directory');
+    }
+    try {
+        const status = await lstat(candidate);
+        if (status.isSymbolicLink() || !status.isFile()) {
+            throw new Error('reconciliation receipt is not a regular file');
+        }
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) {
+            throw error;
+        }
+    }
+    return candidate;
+}
+export async function readReconciliationReceipt(path) {
+    try {
+        const candidate = await lstat(path);
+        if (candidate.isSymbolicLink() || !candidate.isFile()) {
+            throw new Error('reconciliation receipt is not a regular file');
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            return null;
+        }
+        throw error;
+    }
+    const parsed = ReconciliationReceiptV1Schema.safeParse(await readJson(path, null));
+    if (!parsed.success) {
+        throw new Error('reconciliation receipt is invalid');
+    }
+    return parsed.data;
+}
+export async function writeReconciliationReceipt(path, receipt) {
+    try {
+        const status = await lstat(path);
+        if (status.isSymbolicLink() || !status.isFile()) {
+            throw new Error('reconciliation receipt is unsafe');
+        }
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) {
+            throw error;
+        }
+    }
+    await writeJson(path, receipt);
+}
+export async function collectSupersededReconciliationArtifacts(projectId, specId) {
+    const handoff = join(projectDataDir(projectId), 'handoffs', specId);
+    const candidates = [
+        ...ARTIFACTS.map((name) => ({
+            artifactId: `handoffs/${specId}/${name}`,
+            path: join(handoff, name),
+        })),
+        {
+            artifactId: `handoffs/${specId}.md`,
+            path: join(projectDataDir(projectId), 'handoffs', `${specId}.md`),
+        },
+    ];
+    try {
+        const names = await readdir(handoff);
+        for (const artifactName of names.filter((candidate) => /^contract-validation-[A-Za-z0-9_-]+\.json$/u.test(candidate))) {
+            candidates.push({
+                artifactId: `handoffs/${specId}/${artifactName}`,
+                path: join(handoff, artifactName),
+            });
+        }
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) {
+            throw error;
+        }
+    }
+    return Promise.all(candidates.map(async ({ artifactId, path }) => {
+        try {
+            const stat = await lstat(path);
+            if (stat.isSymbolicLink() || !stat.isFile()) {
+                throw new Error(`unsafe artifact ${artifactId}`);
+            }
+            return { artifactId, sha256: reconciliationDigest(await readFile(path)) };
+        }
+        catch (error) {
+            if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+                return { artifactId };
+            }
+            throw error;
+        }
+    }));
+}
+export async function readCommittedReconciliationReceipts(projectId, specId) {
+    try {
+        const directory = await assertAncestors(projectId, specId, false);
+        const root = await realpath(directory);
+        const names = await readdir(root);
+        const receipts = await Promise.all(names
+            .filter((name) => REQUEST_ID.test(name.replace(/\.json$/u, '')) && name.endsWith('.json'))
+            .map((name) => {
+            const path = join(root, name);
+            if (isOutside(root, path)) {
+                throw new Error('reconciliation receipt path escapes its directory');
+            }
+            return readReconciliationReceipt(path);
+        }));
+        return receipts.filter((receipt) => receipt?.state === 'committed');
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            return [];
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=lifecycle-reconciliation-io.js.map

package/dist/engine/lifecycle-reconciliation.d.ts

@@ -0,0 +1,16 @@
+import type { ReconciliationIo, ReconciliationReceiptV1, ReconciliationSpecSync } from '../types/handoff-artifacts.js';
+import type { ReconciliationInvocationContext, ToolResult, UpdateStatusInput } from '../types/index.js';
+/** The registrar, not caller-controlled tool input, establishes local authority. */
+export declare function runWithTrustedLocalMcpContext<T>(callback: () => T): T;
+export declare function currentReconciliationInvocationContext(): ReconciliationInvocationContext;
+/** Read all committed receipts. Invalid or unsafe recovery state fails closed. */
+export declare function readCommittedReconciliations(projectId: string, specId: string): Promise<ReconciliationReceiptV1[]>;
+export declare function reconcileImplementingSpec(args: {
+    input: UpdateStatusInput;
+    projectId: string;
+    projectPath?: string;
+    context: ReconciliationInvocationContext;
+    syncSpecFiles: ReconciliationSpecSync;
+    io?: ReconciliationIo;
+}): Promise<ToolResult>;
+//# sourceMappingURL=lifecycle-reconciliation.d.ts.map